Extracted

• • Target
    047ec4436ec83c5d386e95c6bfad162f40f415382d78cddacaf44726a215177a
  • Size 45KB
  • SHA256 047ec4436ec83c5d386e95c6bfad162f40f415382d78cddacaf44726a215177a
  • MD5 c1ce145fa2a1b75e28542f563f9f4f9e
  • SHA1 66f52429ac5e34ba46386d920795d33351bf4aa0
  • SHA512 2b2fe65489a5bc49e67a82ea8d4fdd02600dac05d63f8d77c8396090a65ce55d9c1977bdb990c0364ccb232c524ed2dcabc7f594d363164d28efac9b3711aa7d
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1ucP0pycvHPIjzjb3gX3iXrEav44g0DxwVHBDZUx:cuR0JTPjY29ccMcvgj3bQXSXjv44L9UW
  • TLSH
    T195232B0037E8822BF2BE5F78A9F26145867BF6632603D54A1CC441DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2